Deterrence theory in the cyber - century . Lessons from a state - of - the - art literature review

Cyberattacks from a variety of perpetrators are constantly rising. To achieve restraint from attacks, deterrence theory has long been considered a valuable concept. How do criticisms of classical deterrence apply in this relatively new domain, and how does cyberdeterrence differ? Can offensive cyber capabilities be effective in deterring adversaries or must kinetic retaliation be “on the table”? Freedman differentiates deterrence-by-retaliation and deterrence-by-denial; immediate versus general; narrow versus broad; and central versus extended deterrence. The authors argue for denial and retaliation as complimentary parts of an overall strategy consisting of resistance, resilience and responses. Unlike nuclear deterrence, cyberdeterrence is not a game of great powers or that of nation-states alone and grey zones serve only rogue actors in the medium-term. Only the establishment of clear rules, similar to the Budapest Cybercrime Convention, enables effective responses to prevailing threats. Agreement on international rules on civilian critical infrastructures would move the superficial discussion on whether or not cyberattacks are legitimate to the more relevant debate on which targets are acceptable, providing clarity for the development of effective military strategy.